Hacking Team Hack Unearths Two More Devastating Adobe Flash Exploits

We reported last
week on a new zero-day
vulnerability in AdobeFlash that
was revealed following the leak of data from the Italian hacking group
"Hacking Team". It's hardly a surprise when such a vulnerability is found in either Flash or Java, and as sad as it is, it's not even
surprising to learn that two
more have been found. Oy!

The latest vulnerabilities, named CVE-2015-5122 and
CVE-2015-5123, are considered critical, and affect the Flash player on Windows, OS X, and Linux. A verbatim threat to last week's
vulnerability, "successful exploitation could cause a crash and
potentially allow an attacker to take control of the affected system."

The affected versions are as follows:

Adobe Flash Player 18.0.0.203 and earlier versions for Windows and Macintosh

Adobe Flash Player 18.0.0.204 and earlier versions for Linux installed with Google Chrome

Adobe Flash Player Extended Support Release version 13.0.0.302 and earlier 13.x versions for Windows and Macintosh

Adobe Flash Player Extended Support Release version 11.2.202.481 and earlier 11.x versions for Linux

To see which Flash version you have, you can simply highlight any Flash element and see the version in the drop-down menu. Or, you can check here. It seems that Google wasted no time in pushing out an updated version, as of the time of writing, the version I'm seeing in Chrome is 18.0.0.205 -- two minor iterations higher than the vulnerable version. What's interesting about that is that .203 for Windows and OS X is still considered the latest version available according to that URL.

If you're not a Chrome user, you'll have to wait it out. But given Chrome does have it, it seems like an official release is imminent.